/ Register

Get the most out of your Centmin Mod LEMP stack
Become a Member

Beta Branch fix emailnotify.sh leaving SES SMTP credentials in /tmp in 140.00beta01

Discussion in 'Centmin Mod Github Commits' started by eva2000, Oct 23, 2026 at 8:54 AM.

Previous Thread Next Thread
Loading...
  1. Oct 23, 2026 at 8:54 AM #1
    eva2000

    eva2000 Administrator Staff Member

    60,036
    12,571
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,224
    Local Time:
    5:27 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    fix emailnotify.sh leaving SES SMTP credentials in /tmp in 140.00beta01

    send_ses_mail() wrote the SMTP session, including the base64 AUTH LOGIN
    username and password, to a world-readable /tmp/email_body_template.txt and
    never removed it, so any local user could read the SES credentials.

    Changes:
    - tools/emailnotify.sh: write the SMTP session to a 0600 file in a private
    mktemp -d directory and remove it on exit, including when openssl fails or
    the script is killed

    Continue reading...

    140.00beta01 branch
     
Previous Thread Next Thread
Loading...

.